Blackoutware is a ransomware-as-a-service (RaaS) operation that was first observed in late 2023. It functions as a financially motivated cybercrime group, deploying ransomware that encrypts user files and threatens data exfiltration to coerce victims into paying a ransom. The group is distinguished by its use of the '.blo' extension for encrypted files and a specific ransom note titled '!!! WARNING!!!.txt'. It operates under a double-extortion model, combining file encryption with the threat of public data leakage if demands are not met.